In recent years, with an increase in the use of a network, illegal access to the network has increased. Therefore, the importance of a security technique for detecting illegal attacks and network errors and interrupting the access has increased.
In the related art, the ratio of any one of traffic information items of a network (or a system), such as an address, a protocol, a port number, and the number of packet, is used to analyze a change in the corresponding item, in order to detect network errors (that is, abnormal situations caused by attacks). As another known technique, data transmitted over a network is displayed on a coordinate plane or as a geometric figure according to a predetermined protocol, thereby displaying the abnormal situations of the entire network (Reference Document 1; Korean Patent Application No. 10-2003-0008826, and Reference Document 2; IEEE Network Vol. 18, No. 5, PP. 30-39, September/October 2004, Hyogon Kim, Inhye Kang, Saewoong Bahk, Real-Time Visualization of Network Attacks on High-Speed Links).
The known methods cannot display details of the current state of the network on one screen. Therefore, it is difficult for a user to intuitively recognize a source of network security threat and places damaged by illegal attacks.
As described above, when the user or the administrator cannot intuitively recognize the current security situation of the network, it is difficult to rapidly cope with the abnormal situations of the network, which results in an increase in damage.